I’m sure we’ve visited this question before, but `400 Bad Request`, strictly speaking, means the request wasn’t a well-formed HTTP request, which isn’t the case here. `403 Forbidden` is, by the letter of the spec, a generic “no” response, but has connotations of authorisation in the real world. Probably the best option is `422 Unprocessable Entity`, patched into HTTP as part of [RFC 4918](https://tools.ietf.org/html/rfc4918), which is for semantic, rather than syntactic, errors.